Patent Application
20200027318
The invention is in the field of vending machine technology, electronic systems, and network technology, and relates in particular to a vending machine that can be used, for example, with access systems, automatic teller machine systems, and ticket vending machine systems.
Vending machines of this type comprise a user interface that allows the machine to capture instructions from the user, data, or money for further processing. The latter can be accomplished by inputting coins, banknotes, credit cards, or other cards, for example. Digital data, e.g. PIN data for card use, or other data, such as authentication data, can likewise be captured.
In the vending machine, the collected money or data are then fed to an automatic and electronic processing system, which triggers an action depending upon the application of the machine, e.g. it grants direct access or issues an authorization for indirect access (e.g. in the form of a card or a voucher). In the case of overpayment, change can also be dispensed.
These vending machines comprise a multitude of components that are necessary for providing the required functionality, along with a user interface designed to interact with the user. The components are integrated into a vending machine body, which serves as a kind of housing. Depending upon the field of application and use, the vending machine further comprises various electronic components, such as a banknote acceptor with a counting function, an RFID reader for reading out data that are stored on an RFID card, and/or a printer for printing cards or paper vouchers.
For instance, EP 0935219 B1 describes one example of a vending machine designed as a ticket vending machine for parking lots, which issues and receives returned parking authorization cards. For this purpose, parking-related data (such as parking time, parking fee) are written by the vending machine onto the authorization card. A cost exemption option can also be provided.
In addition to the above-described use for parking lot ticket vending machines, other uses for vending machines may involve access control, bank transfers, or the dispensing of tickets, or other applications.
Until now, such vending machines have been designed, fitted and assembled for their intended purpose, and then delivered to the customer. After delivery, it has heretofore not been possible to modify the functionality and the security requirements of the vending machine without extensive retrofitting measures. It would be desirable for the vending machine to be alterable in terms of its functionality after delivery as well, and even during operation, thus allowing it to be adapted flexibly to current requirements.
Another important aspect relates to the security of the vending machine. During operation, the vending machine typically contains a certain amount of cash. It is therefore tremendously important to protect and secure these vending machines against unauthorized access and unauthorized vending machine openings.
In the prior art, DE 10 2010 001570 A1 discloses a vending machine which has a camera for recording images of the user operating the machine. The images captured by the camera are then compared with reference images stored in a database to identify matches, perform an authorization of the user and, if necessary, activate or deactivate other functions of the vending machine.
Proceeding from the known prior art, the object of the present invention is to provide a vending machine which is tamper-resistant and to provide a method for operating a vending machine and a vending machine system, which is secure in terms of the storage of sensitive data (e.g. personal data of the user) and is flexible in terms of production, and which can thus be manufactured and operated more cost-effectively.
This object is attained by the respective subjects of the appended independent claims, in particular by a vending machine, a door element for a vending machine, a method for operating a vending machine, and a vending machine system. Advantageous embodiments are the subject of the dependent claims, the description, and the drawings.
According to a first aspect of the invention, the object is attained by a vending machine, in particular a card vending machine, comprising:
a door element and
a body, wherein the body is sealed by the door element when the vending machine is in operation, keeping the vending machine in a secured closed state.
A plurality of integrated operating modules are formed in the door element, wherein the operating modules comprise
multiple screen elements for inputting and outputting data, for example in the form of a (graphic) user interface, and
multiple insertion and dispensing units for the insertion and dispensing of value units in the form of physical objects, for example for the insertion and dispensing of money, coins, cards, and chips, and wherein at least one insertion and dispensing unit is designed as a card dispensing unit.
An entire front panel of the door element is formed as a continuous glass panel, into which the operating modules are integrated flush with the (top) surface and without gaps during operation of the vending machine (i.e. after assembly and delivery of the vending machine), the screen elements being formed as a touch-sensitive screen or touchscreen. For the screen elements, a capacitive sensor technology is preferably used. One example of a touchscreen with sensor technology is described in greater detail in GB 2348039 B. With capacitive screens, an additional piezo element layer with piezo elements can be used to detect tactile feedback.
In a preferred embodiment of the invention, a capacitive touchscreen technology with multi-sensor functionality is used for the screen elements formed as a touchscreen, in which simultaneous touches can also be detected. Typically, the touchscreen comprises a touchscreen sensor as the actual input and output unit, a controller that can be arranged in or on the touchscreen sensor, and optionally a driver that can be arranged in the operating module. In an alternative and likewise preferred embodiment of the invention, the touchscreen sensor can be embodied as a projected capacitive sensor (usually called “PCT”=“Projected Capacitive Touch” or “PCAP”). In that case, the sensor uses two planes with a conductive pattern (such as stripes or diamonds). The planes are isolated from one another. When a finger is located at the crossing point of two strips, the capacitance of the capacitor will change, and a greater signal will arrive at the receiver strip. Thus, this signal change can be measured accurately on the basis of the X and Y coordinates, and multiple touch points can be precisely defined. The flow of current from the corners of the touchscreen to the touch point is proportional to the XY coordinates. The key advantage of this system is that the sensor can be mounted on the back of the cover glass, since touch recognition is “projected” through the glass. Thus, operations are performed on the practically wear-free glass surface. Moreover, the recognition of gestures and multiple touches (i.e. multi-touch) is possible. In other embodiments of the invention, however, resistive or inductive or other sensor technologies for touchscreens may also be used. Basically, the touchscreen sensor is a user interface (also called a monitor or display) and comprises the sensor for detecting the input signals for controlling and operating the vending machine, along with a display on which interactive surfaces, switch elements, control fields and/or input fields for controlling the vending machine can be displayed.
During operation of the vending machine, i.e. once it has been assembled and delivered, the glass panel and the operating modules integrated therein form an integral component. More particularly, the operating modules are embedded in the glass panel, flush with its surface. The operating modules and the front panel of the vending machine form a continuous (user) interface. The security of the vending machine can thereby be significantly increased.
During manufacturing of the vending machine, the operating modules can be inserted into the glass panel, more particularly into prefabricated punched-out sections of the glass panel, and sealed/grouted. A rubber-like or silicone-like material can be used for this purpose. In an advantageous refinement of the invention, the operating modules can thus be exchanged flexibly during production. For example, a banknote reader can be replaced by a card reader, and vice versa. To further simplify the assembly process, the operating modules may be consistent in terms of size. Otherwise, the size of the operating modules is adapted to the respective cutouts provided in the glass panel. In the assembled state, however, i.e. during the time phase after completion of assembly and e.g. after delivery of the vending machine, the operating modules cannot be exchanged or removed without tools. In particular, the operating modules are installed to form a continuous, monolithic unit and integrated into the glass panel.
The operating modules are preferably structured in accordance with a tile arrangement. The operating modules are designed for use in and for integrative connection to the glass panel. The functionality of each tile or of each integrated operating module is encoded in an electronic circuit. In a preferred embodiment of the invention, a display element that extends over nearly the entire width of the glass panel is formed as the top element. Beneath it are two or three rows of tile elements. The first row of tile elements can implement various payment modalities, such as a coin acceptance operating module, a banknote input operating module, and a card input operating module. The second row, below the first, may contain operating modules for dispensing cards (e.g. in combination with a card printer). The arrangement of the tiles and the arrangement of the operating modules can be flexibly designed for the particular application.
In the assembled state, the front panel of the door element comprises a plurality of different operating modules, some of which are formed as screen elements. All of the operating modules are integrated into the glass panel such that they form a continuous surface. There are no protrusions protruding from the plane of the front panel. This has the important advantage that the front panel of the vending machine can be easily cleaned and is less readily soiled. Furthermore, due to the tile-like structure, orientation for operation of the machine is easy. The operating modules are permanently installed and integrated into the glass panel. For this purpose, the connection between operating module and glass panel is grouted or sealed. This has the important technical advantage that the front panel of the vending machine having the glass panel is completely impervious to splashed or dirty water.
The vending machine may be designed to print onto the card. In that case, a data carrier (paper, plastic) can be imprinted with data. The data may be analog data (image, characters, etc.) or digital data (e.g., as a code for a chip or transponder card). The data are stored exclusively on the server. No association between session data (data input by the user or collected automatically during operation of the machine) and the user's personal data is stored in the vending machine or on the card. Thus, in the event of tampering, even a corrupted process cannot read data from either the card or the vending machine that might enable an association with the user's personal data (e.g., such questions as: “When has which user fed what amount of money into the machine?”). Such associative relationships can be created only on the server by means of additional, preconfigured security measures.
The vending machine may be designed to output information. The information can be provided as a digital data set.
In principle, the vending machine is designed for dispensing cards or value units (money, prepaid cards, etc.) or information, e.g. in the form of a (digital) data set, and not for dispensing goods and products. The dispensing of goods can be controlled and implemented via downstream systems. However, the vending machine may be used to dispense an authorization, e.g. in the form of a card, for a product dispensing system.
In one advantageous embodiment of the invention, the vending machine comprises a lighting unit, which may have a plurality of lighting segments, wherein one of the lighting segments is arranged, in particular, on the front panel of the door element and extends along an outer edge of the door element, and is used to illuminate the entire vending machine. This entire lighting module can be switched on and off and controlled via an electronic circuit. Thus, the lighting module can be activated, e.g. depending upon a specific operating state of the vending machine. For this purpose, a detector may be provided, in particular, which detects the presence of a user in front of the vending machine and activates the entire lighting module only in the presence of a user in the operating position. In addition, a plurality of individual tile lighting elements can be provided for illuminating the individual operating modules or the individual tiles of the glass panel. The tile lighting elements preferably are not formed in the individual operating modules, but directly on the glass panel in an area around the respective cutouts for insertion of the operating modules. The tile lighting elements can likewise be switched on and off and controlled via an electronic circuit. For example, the system may be configured, e.g. such that only the next tile to be used in the operating procedure and/or the tile currently being used is illuminated. This makes it possible to guide the user through the vending machine control menu and to indicate to the user which operating modules are to be used, and also to mark these modules visually by a corresponding signal output. The electronic circuit can still be reconfigured and modified during operation. The intensity, the mode (e.g., flashing), and/or the color of the lighting segments on the front of the door element or along the outer edge of the door element are freely selectable or configurable. The flexible color selection can be used to indicate different states (e.g., flashing red in the case of malfunction). These lighting segments may be embodied as extending around the entire periphery and/or as intermittent.
In a further advantageous embodiment of the invention, the vending machine comprises a server interface to an external server, wherein a database can be connected to the server. If multiple vending machines are operated in one system, they can thus be controlled uniformly by a corresponding programming of the server.
In a further advantageous embodiment of the invention, at least one operating module of the vending machine is designed as an RFID printer for printing the card to be dispensed. The card can be printed as a paper card or a plastic card. The card can be printed with data, for example in the form of a QR code or a barcode, or as a chip card, e.g. as an RFID card. Alternatively or cumulatively, for printing the card with digital data, a magnetic strip card or an image card can also be dispensed, for example as a customer card bearing an image of the particular user.
In a further advantageous embodiment of the invention, the door element, more particularly at least one metal frame element of the door element, has approximately the same structural height as the body of the vending machine. The glass plate (glass panel) can be mounted on a metal frame element. In one embodiment of the invention, the glass plate extends over the entire height of the vending machine and thus corresponds to the height of the body. In an alternative embodiment of the invention, the height of the glass plate is slightly (5-15%) lower than that of the body and ends about 10-25 cm above the ground. In this lower range of 10-25 cm, a metal plate is provided to prevent damage caused by collisions with moving parts and to enable the body to be sealed off completely by the door element. In both embodiments (the glass plate has the full height or the partial height of the body) the door element seals the body off completely.
The glass of the glass panel is preferably single-pane safety glass. The glass panel can be treated with stealth effect printing. Stealth effect printing is a rear printing process with which special effects can be achieved specifically for touchscreens. Stealth effect printing is used to display black borders or touchpoints at defined locations. The printing is preferably in black. When the display is shut off, the entire surface appears black. When the display is switched on, the printed areas appear as borders, hidden areas, or fixed menu items. Thus, edges on the glass panel, for example around selected operating modules, can be highlighted without a light source (e.g., LED) lighting up.
In a further advantageous embodiment of the invention, the vending machine comprises a locking system for opening and locking the body. The locking system is preferably an electronic locking system. It can be operated using an electronic key, e.g. on a mobile data carrier, such as an RFID card or a code on the mobile phone display, or via a PIN number entered in the keypad or on the display. The locking system of the vending machine operates a mechanical locking and unlocking mechanism, which is located behind the glass panel in the body and locks or opens the body with the door element. Advantageously, the position of the mechanical locking and unlocking mechanism is not visible from the outside. In particular, no lock or comparable component is located on the front side of the door element. The entire locking and unlocking mechanism is located completely behind the door element, i.e. on the inner side of the door element and in the interior of the vending machine. This has important security advantages, since damage to the mechanical locking and unlocking mechanism is made difficult by its unknown position.
In one advantageous refinement, in addition to being activated by the electronic locking system, the locking and unlocking mechanism can be activated by a mechanical emergency activation system. The mechanical emergency activation system may be designed as a cable/spindle system which activates a spindle, which is in engagement with the mechanical locking and unlocking mechanism, via a borehole at a predefined position in the body.
The door element is mounted on the body so as to pivot about a vertical axis. The vertical pivot axis for the door element may be located on the right or left side of the vending machine. During operation, the door element closes and locks the body of the vending machine in a secured manner. The term “secured” includes two aspects: First, the locking and unlocking mechanism is not positioned on the front panel of the door element or on any other external element of the vending machine, nor is it visible from the outside. Second, it can only be unlocked using an electronic security system. The settings of the electronic security system are configurable. Thus, in a simple embodiment of the invention, unlocking can be effected only by detecting an electronic code. In more complex embodiments, additional security measures may be necessary, such as collecting user data and comparing these with reference data on the server. The door element can be pivoted, in particular, to an angle up to approximately 90° in an open state if the electronic locking system has been opened. Since, according to a preferred embodiment of the invention, the door element has approximately the same structural height as the body of the vending machine, there is the technical advantage that when the door is opened, the entire interior of the body or of the vending machine, i.e. the interior of the vending machine over its entire height and width, is accessible, which is particularly advantageous for maintenance and service work. These can then be carried out more quickly and easily, as the components are more easily accessible.
In a further advantageous embodiment of the invention, a spring element is arranged in the body of the vending machine and, during a locking process, i.e. as the door element is pivoting from an open to a closed state, exerts a force counteracting a closing movement. This creates a “soft-close” feel. With this design, this haptic effect can advantageously be provided without the installation of costly and structurally complex dampers.
In a further advantageous embodiment of the invention, the body of the vending machine comprises a self-supporting frame structure, in particular made of metal, which can be planked with various planking materials (glass, metal, wood, plastic, etc.). In addition, user-specific information fields, e.g. with advertising messages, can be displayed both on the body and/or on the door element.
In a further advantageous embodiment of the invention, the door element has a sandwich construction. The sandwich construction comprises a plurality of layers and in particular an outer glass layer (the glass panel itself), a metal layer, an electronic layer for supporting electronic components, and an inner cover layer, in particular made of metal, which serves to cover the electronic components. The sandwich construction increases tamper resistance.
In a second aspect, the invention relates to a door element for a vending machine. The door element is tamper-resistant and has a continuous, predominantly flush front panel with integrated operating means, with the front panel preferably being designed as a touch-sensitive display.
According to a further aspect of the invention, the above object is attained by a method for controlling and operating a vending machine, in particular a card vending machine, which may be designed, inter alia, to dispense tickets or cards. The method comprises the following method steps:
Detecting an input signal from the user on an operating module of the vending machine, e.g. on a touch-sensitive screen surface of the vending machine (e.g. for selecting a payment modality or for entering authorization data). The input signal may be detected as a gesture or as a touch signal on a touchscreen display. On other operating modules, the detection of the input signal may also involve detecting the insertion of coins or the insertion of a cash card or some other input.
Generating instructions for controlling the vending machine into a changed operating state in response to the detected input signal
Executing the generated instructions. The instructions may be operating instructions directed to the user (e.g., an instruction to insert a card or cash, issued on a screen element), or the instructions may be commands that must be executed directly by the vending machine (such as printing an in-stock card, issuing signals on a user interface, or triggering a counting process for coins, etc.).
Checking to determine whether the instructions have been carried out correctly and completely. This may involve automatic verification, for example, that the input of money, a card, user input and/or authorization data has been executed in the correct form and completely. If so, the following step is initiated:
Dispensing a card (e.g., as a printed paper voucher or a plastic card, as a receipt or as a chip card). Optionally or cumulatively, it is also possible for information to be output, in particular as a data set, which can be displayed, e.g., on the display.
The dispensed card may be dispensed with or without a value unit. The value unit may be printed onto the card in the form of a digital code (e.g., RFID transponder code) or a barcode, etc. The value unit can be evaluated by a downstream system (purchasing system, access control system, ticket system, parking system, etc.) as authorization.
Located inside the vending machine is a magazine which holds a number of cards. Each of these cards held in reserve in the vending machine bears a unique digital, electronic, and/or analog identifier (e.g., in the form of a barcode). The identifier is assigned to the card. This unique identifier (UID) is also stored in the server. When a card is dispensed by the vending machine, a dispensing data set is automatically transmitted by the vending machine to the server, signaling that the card having said unique identifier has been dispensed. After the card has been dispensed by the vending machine and after the unique identifier assigned to the dispensed card has been transmitted to a central server, the unique identifier, optionally along with additional data, can be forwarded to downstream systems (such as an access authorization system, a payment system, etc.). In this embodiment of the invention, no session data (i.e., data related to the current operation of the vending machine by way of user input; session data may involve input from the user or personal data of the user, such as name, amount of money, etc.) is written onto the card.
Optionally, additional data sets may also be transmitted in the dispensing data set. In the preferred embodiment of the invention, the dispensed card is not written on by the vending machine. This enables security to be significantly increased because even if the card is lost, no personal data of the user and no session data are stored on the card. Thus, no data associated with previous inputs, input signals, or personal data of the user are stored on the card.
According to a preferred embodiment of the method, before detection of the input signal in terms of time, a presence signal can be detected by means of a detector in order to activate the method, and then processed. This has the technical advantage that unintended operations of the vending machine can be prevented, for example, if a person swipes a control panel in passing but does not intend to activate it. In that case the detector, e.g. in the form of an infrared detector, can detect the duration of the presence of the supposed user and if the presence is too brief, can leave the modules of the vending machine inactivated and unlit. The signals detected by the detector are processed only internally by the vending machine and are not transmitted to the server or the database. This is an advantage in terms of the security of the data sets to be processed and transmitted, since no personal data sets (in this case, user image data) are transmitted.
According to a further refinement of the method, authorization data identifying the user may be captured prior to detection of the input signal. The captured authorization data may be sent anonymously to a server connected for data exchange and stored there, in which case deanonymization is possible only on the server in interaction with a server-based security measure. This ensures that a deanonymization of the recorded authorization data is not possible on the dispensed card or on the vending machine, since the security measure required for deanonymization (e.g., a cryptologic key) is available only on the server. The security of the method can advantageously be increased as a result.
The vending machine can be operated in three operating modes. These are, specifically:
an operating mode in which the vending machine is operated to dispense the card and is in a closed state,
a cashier mode, in which value units located inside the vending machine are removed,
a service mode for servicing or maintaining the vending machine and its modules,
wherein the service mode and the cashier mode are initiated automatically when a service identifier or a cashier identifier has been read in by the vending machine and an electronic locking system has unlocked and opened the door element, in which case a service menu or a cashier menu is automatically output on the touch-sensitive display unit. In that case, the service technician or the cashier technician will have a corresponding specific identifier (e.g., in the form of an electronic key, optionally on an additional card or on another, optionally additional mobile data carrier), which is read in via the user interface of the vending machine. When this identifier is read in, the cashier mode or service mode of the machine is automatically initiated, which usually requires further input.
According to a preferred embodiment of the method, operator errors are detected automatically and are processed in an error handling routine. Corrective actions may be output automatically on the touch-sensitive display unit.
According to a further aspect of the invention, the above-stated object is attained by a vending machine system comprising at least one vending machine as described above, in particular a card vending machine, and a central server, wherein said vending machine and the central server are linked for data exchange via a network protocol (e.g., http/s), and wherein the vending machine, upon detection of an input signal on the vending machine, forwards a unique identifier of the card to the central server. For protection against tampering, it is ensured that the identifier is linked to one of the input signals, to session data, and/or to additional data identifying the user and stored only on the server, thereby making the system secure against tampering. If necessary, the identifier can be forwarded to the central server after the card has been dispensed.
Further details of the invention and in particular exemplary embodiments of the vending machine or vending machine system according to the invention will be explained in the following, with reference to the accompanying drawings.
In the drawings:
The vending machine A may be designed to print cards to be dispensed. For this purpose, a transponder system with an RFID card can be used. An RFID card is a contactless chip card with wireless data and energy transmission. The RFID card typically consists of two physical carrier layers (e.g., thin plastic films) in which an RFID tag, i.e., a chip that contains the processor, the memory, and the transponder, is embedded, along with the transmitting and receiving antennae. For improved security, in a preferred embodiment of the invention further functionalities, such as error correction, password protection, encryption, and write protection, may be integrated into the electronic circuit of the card. Additionally, rights may be assigned, so that the card can only be read out (or written and read out), for example, depending upon the application. The tag integrated into the transponder card may be designed as an active tag, as a semi-passive tag, or as a passive tag. The active tags have a transmitter and may have a rechargeable battery; the passive tags draw the necessary energy from the carrier signal of the RFID reader. The RFID transmission is focused on the near range and can bridge distances of a few centimeters to several meters, depending on the RFID frequency, with the active RFID cards having a much wider range than the passive cards. The cards operate wear-free, are impervious to dirt and moisture, and can be checked merely by being held close to an RFID reader; they do not need to be taken out of the pocket for access control. The RFID reader may be a component of the vending machine system or of a downstream application system.
multiple screen elements D intended for the input and output of data
multiple insertion and dispensing units for value units W, intended for the insertion and dispensing of value units, such as cards or cash. At least one of the insertion and dispensing units for value units W is designed as a card dispensing unit and serves to dispense a card. In the exemplary embodiment shown in
A keypad with mechanical keys for entering data, e.g., for entering PIN data. Alternatively or cumulatively, in place of mechanical keys the keypad may be in the form of a virtual keyboard, which is displayed in a display or on a screen element D.
In addition to the operating modules BM, the front panel V may comprise a detector Dt. The detector Dt may be designed as a camera in the upper region of the vending machine for detecting, e.g., the presence of a user in an operating position. The detector Dt may also be designed as a radar or ultrasonic sensor. The front panel V may further comprise a logo element in the lower region. This serves to display additional information on the front panel V of the vending machine. The logo element can be designed and configured (e.g., with respect to lighting) according to customer requirements.
As is clear from
In step S4, a check is made to determine whether the instruction has been carried out correctly and completely (by the user or by the vending machine A). Only if the answer is yes is the card dispensed in step S5. Otherwise, a modified instruction can be generated in step S7, which is then processed further as described above. In step S6, the unique identifier UID of the dispensed card can be transmitted to the server S. The unique identifier UID can be processed by additional security measures on the server (and only there) to calculate additional data sets, such as statistical analyses of the number of cards dispensed within a given period of time and the need to refill cards in the vending machine, or tracking of which actions have been performed on the vending machine in order to enable the situation to be reconstructed in the case of misuse. This also increases the security of the vending machine.
When the door is opened electronically, lock M1 unlocks and releases the pin M2. The door element can then be pulled open.
If the supply of power to the locks should fail, for example, it is possible for a hole to be drilled in the cabinet housing at a predefined emergency position NP, thereby enabling access to the emergency release. By means of a rotary movement at emergency position NP, control wires SZ are tightened. The pulling movement of the control wires SZ effects a mechanical opening of all the locks.
All features detailed and shown in connection with individual embodiments of the invention may be provided in different combinations in the article according to the invention, in order to realize their advantageous effects simultaneously.
All method steps of the method may be implemented by means of electronic devices (circuits) suitable for carrying out the respective method step. Conversely, all functions performed by objective features may constitute a method step of a method. For instance, the method step “generating instructions” may be implemented by an instruction module that has the said corresponding functionality.
The scope of the present invention is given by the claims and is not limited by the features detailed in the description or shown in the figures.
| Number | Date | Country | Kind |
|---|---|---|---|
| 10 2017 101 732.1 | Jan 2017 | DE | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/EP2018/050658 | 1/11/2018 | WO | 00 |
